Data Link Layer Parsing Method in the Environment of Industrial Field Network Address Conflict

Abstract

The present invention belongs to the field of intelligent technology, and discloses a data link layer parsing method in an industrial field network address conflict environment, including: deploying a customized acquisition module at the data link layer to capture original data frames in real time, extract timing features and protocol semantics, and merge the timing features and protocol semantics into a high-granularity data set of multi-dimensional features; designing a multi-rule set based on the high-granularity data set of multi-dimensional features for anomaly detection to obtain an anomaly data frame data set; based on the anomaly data frame data set, dividing the conflict domain according to a time window, calculating the total traffic and the proportion of broadcast traffic in the conflict domain, and judging whether there is an address conflict problem in the conflict domain through the total traffic and the proportion of broadcast traffic. If there is an address conflict problem, use VLAN for isolation; for the isolated conflict domain, visualize the conflict source by establishing a communication relationship graph in the network, effectively improving the stability and security of the industrial field network.

Description

Technical Field

[0001] The present invention relates to the field of intelligent technologies, and specifically to a data link layer parsing method in an industrial field network address conflict environment. Background Art

[0002] Existing data link layer parsing methods in an industrial field network address conflict environment usually rely on static address conflict detection mechanisms, mainly judging through simple ARP table scanning and static rules, ignoring the dynamic changes of timing characteristics and traffic patterns; existing methods often have difficulty accurately detecting complex network conflicts, especially in high-speed and high-load industrial network environments; due to the lack of in-depth analysis of burst traffic, timeliness characteristics, and protocol layer semantics, the accuracy and real-time performance of existing methods are poor, it is easy to miss potential conflict sources, and it is impossible to effectively cope with complex dynamic network environments; therefore, existing methods often have difficulty providing timely and accurate conflict source identification and isolation measures in dealing with large-scale and high-rate industrial networks.

[0003] In view of this, the present invention proposes a data link layer parsing method in an industrial field network address conflict environment to solve the above problems. Summary of the Invention

[0004] In order to overcome the above-mentioned defects of the prior art and to achieve the above object, the present invention provides the following technical solution: A data link layer parsing method in an industrial field network address conflict environment, including:

[0005] Step S1, deploy a customized acquisition module at the data link layer, capture the original data frames of the physical ports in real time, extract the timing characteristics and protocol semantics; and merge the timing characteristics, protocol semantics, and basic information data into a high-granularity data set with multi-dimensional features;

[0006] Among them, the timing characteristics include frame interval, aging distribution characteristics of the frame interval, and burst traffic pattern; the burst traffic pattern is obtained by calculating through the dynamic time block analysis method; in the dynamic time block analysis method, define a dynamic time slice, calculate the number and transmitted bytes of the original data frames in the dynamic time slice, and calculate the frame density and traffic volume; judge whether it is a burst traffic pattern based on the frame density and traffic volume;

[0007] Among them, the dynamic time slice is set by dynamically evaluating the network load and dividing it into low-load or high-load states, and setting the time slice according to the low-load or high-load states and the state between low load and high load;

[0008] Step S2, based on the high-granularity data set with multi-dimensional features, design a multi-rule set, use multiple rules for anomaly detection, and perform marking to obtain an abnormal data frame data set;

[0009] Step S3: Based on the abnormal data frame dataset, divide the conflict domain according to the time window, calculate the total traffic and the broadcast traffic ratio in the conflict domain, and determine whether there is an address conflict problem in the conflict domain through the total traffic and the broadcast traffic ratio. If there is an address conflict problem, use VLAN for isolation; for the isolated conflict domain, visualize the conflict source by establishing a communication relationship graph in the network.

[0010] Further, the specific acquisition method of the customized acquisition module includes:

[0011] Step a1: Hardware interface and network adaptation:

[0012] Use the Intel X520-DA2 dual-port 10G Ethernet network card as the physical interface of the acquisition module; the network interfaces are configured as eth1 and eth2;

[0013] Step a2: Configure data link layer capture:

[0014] Set the network card to Promiscuous mode to capture the frames passing through the network card; use the libpcap library to capture the raw data frames at the data link layer;

[0015] Step a3: Data traffic filtering and preprocessing:

[0016] Integrate the filtering rules to capture Modbus / TCP or Profinet protocol frames;

[0017] Extract and record the following frame header information, including: source MAC address, destination MAC address, frame type, timestamp;

[0018] Use the CRC check technology to verify the integrity of the frame, and discard the frames with failed checks;

[0019] Step a4: Data storage and buffering:

[0020] Real-time store the captured raw data frames into a 2TB SSD hard disk; adopt the FIFO buffer mechanism to delete the oldest data when the buffer exceeds the threshold;

[0021] Step a5: Data transmission interface design:

[0022] Use a 10G Ethernet interface to transmit the captured raw data frames to the upper-layer analysis system in real time;

[0023] Use the UDP protocol to package and send the data frames to the analysis server.

[0024] Further, the specific method for real-time capturing the raw data frames of the physical port and extracting the timing characteristics includes:

[0025] The timing characteristics include frame interval, the aging distribution characteristics of the frame interval, and the burst traffic pattern;

[0026] Retrieve the timestamps in the original data frames; calculate the adjacent original data frame intervals for the timestamps corresponding to adjacent original data frames;

[0027] Calculate the aging distribution characteristics of the frame interval, including the shortest interval, the longest interval, the average interval, and the interval divergence;

[0028] Identify the burst traffic pattern in the data stream through the dynamic time block analysis method; where the data stream consists of multiple original data frames.

[0029] Further, the specific method for calculating the burst traffic pattern obtained through the dynamic time block analysis method includes:

[0030] Define dynamic time slices, aggregate the original data frames within the time slices, and obtain the number and transmitted byte count of the original data frames in the dynamic time slices; calculate the frame density based on the number of original data frames in the time slices and the time of the dynamic time slices;

[0031] Calculate the traffic volume based on the transmitted byte count in the time slices and the time of the time slices;

[0032] If the frame density or traffic volume within the Pth time slice exceeds the set limit, then a burst traffic pattern appears in this time slice, trigger the warning mechanism, and record the start and end timestamps of the burst traffic pattern.

[0033] Further, the specific method for defining the dynamic time slices includes:

[0034] Obtain the load metric data of the original data frames, including frame rate, bandwidth utilization rate, and resource occupancy rate;

[0035] Define the load metric data status classification rules according to the load metric data, including:

[0036] Low load: frame rate < 40%Thr cur , bandwidth utilization rate < 30%Thr cur , CPU occupancy rate < 50%Thr cur ;

[0037] High load: frame rate ≥ 60%Thr cur , bandwidth utilization rate ≥ 60%Thr cur , CPU occupancy rate ≥ 70%Thr cur ;

[0038] Among them, Thr cur is the load threshold, and the progressive threshold update method is used to obtain it;

[0039] When the load is low, set the time slice to W a ; When the load is high, set the time slice to W b ; where, W a and W b are the time slice sizes for low load and high load respectively;

[0040] For the excessive time slice, that is, the load between low load and high load, set the time slice to W c .

[0041] Furthermore, for the high-granularity data set based on multi-dimensional features, design a multi-rule set, use multiple rules for anomaly detection, and perform marking to obtain the specific method of the abnormal data frame data set as follows:

[0042] Rule 1: Filter out ARP data frames according to the frame type in the high-granularity data set of multi-dimensional features;

[0043] For the same source MAC address in the ARP data frame, obtain the number of ARP requests for the same target IP address within a dynamic time slice;

[0044] If the same source MAC sends J ARP requests within the time slice, mark it as abnormal;

[0045] Rule 2: For the corresponding target IP address in the ARP request frame; group by the target IP address and obtain the source MAC addresses in each group; if the same target IP address is requested by K source MACs within the time slice, mark the multi-dimensional high-granularity data corresponding to the ARP request as abnormal;

[0046] Rule 3: For the ARP request frame and the ARP response frame;

[0047] For each ARP request frame, check whether there is a corresponding ARP response in the next time slice; if the ARP request sent by the source MAC address does not receive a response, mark it as abnormal;

[0048] Rule 4: When D source MAC addresses are bound to the same target IP address, the target IP address in their ARP requests will appear repeatedly, but the source MAC addresses are different;

[0049] Obtain the target IP address and source MAC address of the ARP request frame; group by the target IP address and obtain the number of different source MAC addresses in each group;

[0050] If the same target IP address corresponds to A source MAC addresses, mark it as abnormal;

[0051] Sort the ARP request frames marked as abnormal according to the time stamp to obtain an abnormal event data set, where each group of data is defined as an abnormal data frame.

[0052] Further, based on the abnormal data frame data set, divide the collision domain according to the time window, calculate the total traffic and the broadcast traffic ratio in the collision domain, and determine whether there is an address conflict problem in the collision domain through the total traffic and the broadcast traffic ratio. If there is an address conflict problem, the specific method of using VLAN for isolation includes:

[0053] Set a fixed time window, and define the abnormal data frames corresponding to the abnormal ARP requests within the time window as the same collision domain;

[0054] For each collision domain, calculate the total traffic and the broadcast traffic ratio in the collision domain;

[0055] Identify whether there is an address conflict problem in the collision domain according to the total traffic and the broadcast traffic ratio;

[0056] Among them, select the total traffic in G historical time windows to calculate the average value and the standard deviation, and calculate the total traffic threshold based on the average value and the standard deviation; select the broadcast traffic ratio in G historical time windows to calculate the average value and the standard deviation, and calculate the broadcast traffic ratio threshold based on the average value and the standard deviation; if the total traffic and the broadcast traffic ratio exceed the total traffic threshold and the broadcast traffic ratio threshold, it means that there is an address conflict problem in the collision domain;

[0057] When it is determined to be an address conflict, divide the source MAC addresses in the abnormal data frames in the collision domain into an independent VLAN for isolation.

[0058] Further, the specific acquisition method for calculating the total traffic and the broadcast traffic ratio for each collision domain includes;

[0059] The acquisition method of the total traffic includes: using the network packet capture tool Wireshark to obtain the total length of the abnormal data frames;

[0060] Calculate the comprehensive length of all abnormal data frames in the collision domain, which is the total traffic;

[0061] The acquisition method of the broadcast traffic ratio includes: using the traversal method to traverse the destination MAC addresses of the abnormal data frames in the collision domain to obtain the number of final broadcast frames;

[0062] Calculate the broadcast traffic ratio based on the ratio of the number of broadcast frames in the collision domain to the total number of abnormal data frames in the collision domain.

[0063] Further, in the isolated conflict domain, the specific method for visualizing the conflict source by establishing a communication relationship graph in the network includes:

[0064] In the isolated conflict domain, retrieve the high-granularity data of the multi-dimensional features of the abnormal data frames in the conflict domain, and establish a communication relationship graph in the network; and visually identify the conflict source in the conflict domain through the communication relationship graph.

[0065] Further, the specific method for establishing a communication relationship graph in the network includes:

[0066] The communication relationship graph is composed of nodes and edges; among them, the source MAC address and the destination IP address are used as nodes, and the timestamp, frame interval, burst traffic pattern, function code, and data field are used as edges; the NetworkX tool is used to construct the communication relationship graph.

[0067] The technical effects and advantages of the data link layer parsing method in the industrial field network address conflict environment of the present invention:

[0068] By deploying a customized acquisition module at the data link layer, the present invention can capture the original data frames in the network in real time, including the data frames captured from the physical ports, frame intervals, and protocol semantic features; this real-time nature ensures that problems in the network can be discovered and processed in a timely manner, avoiding the possible delay problems of traditional methods;

[0069] Use the dynamic time block analysis method to identify and analyze the burst traffic pattern. This method determines whether the traffic is abnormal by defining dynamic time slices and calculating the frame density and traffic volume of each slice; this mechanism effectively detects the burst traffic in the network, provides early warnings for network administrators, and helps to take measures in a timely manner to prevent network congestion or performance degradation;

[0070] This solution designs multiple rule sets based on multi-dimensional features for anomaly detection; through the analysis of the source MAC address, destination IP address, and frame type of the ARP data frames, potential abnormal behaviors can be accurately identified; through the comprehensive application of these rules, the accuracy of anomaly detection is improved, and false alarms and missed alarms are reduced;

[0071] When an address conflict is detected, by dividing the conflict domain into independent VLANs for isolation, the impact of the conflict source on the entire network can be effectively avoided; this method determines whether there is an address conflict problem by accurately calculating the total traffic and broadcast traffic ratio in the conflict domain, avoiding the waste of network resources and performance degradation;

[0072] By establishing a network communication relationship graph, the location of the conflict source and the communication relationship between each node in the network can be clearly visualized; this visualization means helps network administrators quickly locate the conflict source and improves the efficiency of fault troubleshooting;

[0073] By dynamically evaluating load metrics such as frame rate, bandwidth utilization, CPU occupancy, etc., the size of time slices can be flexibly adjusted according to the actual network load conditions; this flexibility enables the method to maintain good performance under different network load states and adapt to various industrial environments;

[0074] Through the above-mentioned various technical means, the system can achieve all-round monitoring, real-time anomaly detection, isolation and location of conflict sources, and fault diagnosis of the industrial field network; it greatly enhances the ability of network management and maintenance, and helps network administrators improve the reliability, stability and security of the network in complex industrial environments. Brief Description of the Drawings

[0075] Figure 1 Schematic diagram of the data link layer parsing method in the industrial field network address conflict environment of the present invention;

[0076] Figure 2 Schematic diagram of the high-granularity feature acquisition step of the present invention;

[0077] Figure 3 Schematic diagram of the data link layer parsing system in the industrial field network address conflict environment of the present invention. Detailed Embodiments

[0078] The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0079] Embodiment 1

[0080] Please refer to Figure 1 and Figure 2 As shown, the data link layer parsing method in the industrial field network address conflict environment of this embodiment includes:

[0081] Step S1: Deploy a customized acquisition module at the data link layer to capture the original data frames of physical ports in real time, extract timing features and protocol semantics; and merge the timing features, protocol semantics and basic information data into a high-granularity data set with multi-dimensional features;

[0082] Among them, the timing features include the frame interval, the aging distribution feature of the frame interval, and the burst traffic pattern; the burst traffic pattern is obtained by calculating through the dynamic time block analysis method; in the dynamic time block analysis method, dynamic time slices are defined, the number of original data frames and the transmitted bytes in the dynamic time slices are calculated, and the frame density and traffic volume are calculated; based on the frame density and traffic volume, it is judged whether it is a burst traffic pattern;

[0083] Among them, the dynamic time slices are set by dynamically evaluating the network load and dividing it into low-load or high-load states, and according to the low-load or high-load states and the states between low load and high load;

[0084] Step S2: Based on the high-granularity data set of multi-dimensional features, design a multi-rule set, use multiple rules for anomaly detection, and perform marking to obtain an abnormal data frame data set;

[0085] Step S3: Based on the abnormal data frame data set, divide the conflict domain according to the time window, calculate the total traffic and the broadcast traffic ratio in the conflict domain, and judge whether there is an address conflict problem in the conflict domain through the total traffic and the broadcast traffic ratio. If there is an address conflict problem, use VLAN for isolation; for the isolated conflict domain, visualize the conflict source by establishing a communication relationship graph in the network.

[0086] The customized acquisition module is a custom network data capture and analysis tool designed for specific application scenarios and performance requirements; compared with general packet capture tools (such as tcpdump, Wireshark, etc.), the customized acquisition module often has higher flexibility, pertinence and efficiency, and can meet the specific needs in the industrial environment;

[0087] The specific acquisition methods of the customized acquisition module include:

[0088] Step a1: Hardware interface and network adaptation: Use the Intel X520-DA2 dual-port 10G Ethernet network card as the physical interface of the acquisition module, which supports high-speed data capture; the network interfaces are configured as eth1 and eth2 to capture data streams from multiple network ports simultaneously;

[0089] Step a2: Configure data link layer capture:

[0090] Set the network card to Promiscuous mode to capture the frames passing through the network card; use the libpcap library to capture the original data frames at the data link layer to ensure that all network traffic including control frames and data frames can be captured;

[0091] Step a3: Data traffic filtering and preprocessing:

[0092] Integrated filtering rules to filter out low-priority data frames that are protocol-independent and capture Modbus / TCP or Profinet protocol frames;

[0093] Extract and record the following frame header information, including: source MAC address, destination MAC address, frame type, timestamp (the exact time at capture, in milliseconds);

[0094] Use CRC check technology to verify the integrity of the frame and discard frames that fail the check;

[0095] Step a4: Data storage and buffering

[0096] Real-time store the captured raw data frames onto a 2TB SSD hard drive; adopt a FIFO caching mechanism to delete the oldest data when the cache exceeds the threshold;

[0097] The storage format is a PCAP file to ensure compatibility with existing analysis tools.

[0098] Step a5: Data transfer interface design:

[0099] Use a 10G Ethernet interface to transfer the captured raw data frames in real-time to the upper-layer analysis system;

[0100] Use the UDP protocol to package and send the data frames to the analysis server to ensure low-latency data transfer;

[0101] Using a customized acquisition module to acquire raw data frames has significant advantages; this module is based on a high-performance Intel X520-DA2 dual-port 10G Ethernet network card, which can capture data frames in real-time in a high-speed and high-traffic industrial network environment and capture all network traffic through Promiscuous mode; the integrated traffic filtering and pre-processing functions ensure that only data frames related to industrial protocols are captured, reducing data redundancy and improving analysis efficiency; CRC check is used to ensure data integrity, and the data is stored in real-time onto a 2TB SSD hard drive, supporting the PCAP format to ensure compatibility with analysis tools; in addition, the 10G Ethernet interface and UDP protocol provide low-latency and high-efficiency data transfer, enabling the acquired data to be quickly transferred to the upper-layer analysis system, achieving real-time monitoring and rapid response, and overall improving the efficiency of network management and fault diagnosis.

[0102] Temporal characteristics mainly focus on the time characteristics of raw data frames, analyzing the time intervals between raw data frames and the burstiness of traffic; this process can help identify periodic traffic and burst traffic patterns, which is crucial for network optimization and traffic monitoring;

[0103] Real-time capture the raw data frames of the physical port, and the specific ways to extract temporal characteristics include:

[0104] The timing characteristics include frame interval, the aging distribution characteristics of the frame interval, and the burst traffic pattern;

[0105] Retrieve the timestamps in the original data frames; calculate the adjacent original data frame intervals for the timestamps corresponding to adjacent original data frames;

[0106] Calculate the aging distribution characteristics of the frame interval, including the shortest interval, the longest interval, the average interval, and the interval degree of dispersion;

[0107] Identify the burst traffic pattern in the data stream through the dynamic time block analysis method; where the data stream consists of multiple original data frames;

[0108] Among them, the frame interval calculation steps include:

[0109] Calculate the time interval between adjacent original data frames and count its distribution to detect abnormal traffic;

[0110] Retrieve the timestamps in the original data frames;

[0111] Calculate the intervals of adjacent original data frames for the timestamps corresponding to adjacent original data frames;

[0112] Example: If the timestamp of frame 1 is t1 = 1633033587.125 (i.e., 12:00:00.125 on October 1, 2023), and the timestamp of frame 2 is t2 = 1633033587.130 (i.e., 12:00:00.130 on October 1, 2023), the frame interval is t2 - t1 = 0.005 seconds (5 milliseconds);

[0113] Among them, the steps for obtaining the aging distribution characteristics of the frame interval include:

[0114] The aging distribution characteristics of the frame interval include the shortest interval, the longest interval, the average interval, and the interval degree of dispersion; where the shortest interval represents the fastest frame transmission speed in the network; the longest interval represents the slowest frame transmission speed in the network; the average interval is used to reflect the overall transmission rate;

[0115] The interval degree of dispersion is used to measure the volatility of the frame interval, that is, the stability of the traffic;

[0116] The burst traffic pattern refers to the abnormal surge of data traffic in the network within a certain specific time period, manifested as the sending of a large number of data frames or packets in a short time; this pattern is usually non-periodic, sudden, and much higher than the normal traffic; in network monitoring and traffic analysis, burst traffic often means some abnormal behaviors or network problems, such as equipment failures, configuration errors, network attacks, or peak loads in certain links of normal operations;

[0117] The steps of the burst traffic pattern include:

[0118] Identify the burst traffic pattern in the data stream through dynamic time block analysis; where the data stream consists of many original data frames;

[0119] Define dynamic time slices, aggregate and statistically analyze the data stream within the time slices to obtain the number of original data frames and the number of transmitted bytes; calculate the frame density based on the number of original data frames in the time slice and the time of the dynamic time slice;

[0120] For example: Set the time slice to 10 milliseconds, which is 0.01 seconds; assume that 50 original data frames are captured within a certain slice, then the true density is 50 / 0.01 = 5000 frames / second;

[0121] Calculate the traffic volume based on the number of transmitted bytes in the time slice and the time of the time slice;

[0122] For example: The total number of bytes of 50 original data frames in the time slice is 8000 bytes, then the traffic volume is 8000 / 0.01 = 800000 bytes / second;

[0123] If the frame density or traffic volume within a certain time slice exceeds the set limit, then a burst traffic pattern appears in this time slice, triggering an early warning mechanism, and recording the start timestamp and end timestamp of the burst traffic pattern.

[0124] Traditional methods usually define time slices based on static fixed values; these fixed values are usually set in advance and cannot flexibly adapt to dynamic network loads; in this method, the size of the time slice is often fixed and cannot be adaptively adjusted according to the fluctuations of the actual load; due to the lack of a dynamic adjustment mechanism, traditional methods may not be able to effectively handle burst traffic or high-load conditions in the case of large load fluctuations, resulting in the time slice being too large or too small, thereby affecting the accuracy of data capture and the real-time nature of analysis;

[0125] The specific ways to define dynamic time slices include:

[0126] Dynamically evaluate the current network load and divide it into low-load or high-load states to select appropriate time slices according to the network state;

[0127] Obtain load metric data, including frame rate, bandwidth utilization, and resource occupancy rate;

[0128] Define the classification rules for load metric data status:

[0129] Low load: Frame rate < 40%Thr cur , Bandwidth utilization < 30%Thr cur, CPU occupancy rate < 50%Thr cur .

[0130] High load: frame rate ≥ 60%Thr cur , bandwidth utilization rate ≥ 60%Thr cur , CPU occupancy rate ≥ 70%Thr cur .

[0131] Among them, Thr cur is the load threshold, which is obtained using the progressive threshold update method; the formula is:

[0132] Thr cur = α * Met cur +(1 - α)*Thr pre , α is the update coefficient, Met cur is the metric value, that is, the frame rate, bandwidth utilization rate or resource occupancy rate, Thr pre is the load threshold of the previous time slice;

[0133] For low load, set the time slice to W a ; for high load, set the time slice to W b ; among them, W a and W b are the time slice sizes for low load and high load respectively;

[0134] For the transitional time slice, that is, the load between low load and high load, the size of the time slice is set to W c , the formula is: W c = W a + β * (W b - W a ), where β is the control over - rate;

[0135] Among them, the specific steps of the progressive threshold update method are: First, initialize a threshold (historical threshold can also be set), and set an update coefficient; then, collect data in real - time, and calculate a new threshold through the weighted average of the current data and the initialized threshold; this new threshold will be updated step by step, rather than relying on a single data point, so as to reflect the gradual change of the updated threshold;

[0136] In contrast, defining dynamic time slices has significant advantages; by evaluating network load in real time and dynamically adjusting the size of time slices, the actual condition of the network can be reflected more accurately; this method gradually updates the threshold according to real-time load data, enabling the time slice to be flexibly adjusted between low load and high load, avoiding the limitations brought by fixed thresholds; especially in the case of large network load fluctuations, the progressive update method can adaptively adjust the size of the time slice, thereby improving the accuracy of data capture and the effectiveness of analysis, ensuring more accurate traffic monitoring and problem location.

[0137] The specific ways of extracting protocol semantic features include:

[0138] Extract the semantic information of the Modbus protocol from the original data frame, including function code and data field;

[0139] Modbus TCP ADU positioning and frame header skipping:

[0140] The source MAC address and destination MAC address contained in the Ethernet frame header, as well as the IP header and TCP header need to be skipped; specifically, the application data unit (ADU) of Modbus TCP starts from the 7th byte of the TCP header; the ADU structure contains the core data of the Modbus protocol.

[0141] Ethernet header: 14 bytes (including source and destination MAC addresses, EtherType);

[0142] IP header: 20 bytes (IPv4 or IPv6);

[0143] TCP header: 20 bytes (excluding option fields);

[0144] So starting from the 7th byte is the starting position of the Modbus PDU.

[0145] Function code extraction: In the Modbus PDU (protocol data unit), the function code is located in the first byte.

[0146] The method for obtaining the data field in the protocol semantic features is as follows: In the original data frame captured by the customized acquisition module, first load the complete frame into memory through libpcap or the underlying driver, then parse the Ethernet header, IP header, and transport layer (such as TCP / UDP) header in sequence, determine the length of each protocol header and locate the subsequent load part; finally, read all the bytes in this load area as the "data field" feature.

[0147] Based on a high-granularity data set with multi-dimensional features, design a multi-rule set, use multiple rules for anomaly detection, and perform marking. The specific ways of obtaining the data set of abnormal data frames include:

[0148] Rule 1: Filter out ARP data frames according to the frame type in the high-granularity dataset of multi-dimensional features;

[0149] For the same source MAC address in the ARP data frame, obtain the number of ARP requests for the same destination IP address within a dynamic time slice;

[0150] If the same source MAC sends J ARP requests within the time slice, it is marked as abnormal;

[0151] For example, within 10 seconds, the source MAC address 00:11:22:33:44:55 sent 5 ARP requests (i.e., the frame type is 0*0806) to the destination IP address 192.168.1.1; if the number of ARP requests sent by a certain source MAC address within the time slice exceeds a threshold (e.g., 3 times), it is considered abnormal, so the multi-dimensional high-granularity data corresponding to this ARP request is marked as abnormal;

[0152] Rule 2: Multiple source MAC addresses are mapped to the same IP address;

[0153] When multiple devices compete for the same IP address, it will cause ARP requests from different source MAC addresses to point to the same destination IP address;

[0154] For the destination IP address corresponding to the ARP request frame; and group by the destination IP address, obtain the source MAC addresses in each group; if the same destination IP address is requested by K source MACs within the time slice, the multi-dimensional high-granularity data corresponding to this ARP request is marked as abnormal;

[0155] For example: The destination IP address 192.168.1.1 was requested by 4 different source MAC addresses: 00:11:22:33:44:55, 00:11:22:33:44:56, 00:11:22:33:44:57, and 00:11:22:33:44:58; if within a time slice (e.g., within 10 seconds), the same destination IP address is requested by multiple source MAC addresses (assuming the threshold K = 3), it indicates that there is a situation where devices are competing for the same IP address, which means abnormal, and the multi-dimensional high-granularity data corresponding to this ARP request is marked as abnormal;

[0156] Rule 3: Missing match between ARP request and ARP response;

[0157] Normally, an ARP request should trigger a corresponding ARP response; if there is no response, it may indicate that an address conflict has caused communication failure;

[0158] For ARP request frames and ARP response frames;

[0159] For each ARP request frame, determine whether there is a corresponding ARP response in the next time slice; if an ARP request sent from a source MAC address does not receive a response, mark it as an anomaly.

[0160] For example, 00:11:22:33:44:55 sent three ARP requests to 192.168.1.1 at 10:00, 10:10, and 10:20 on April 1, 2025, with a function code of 1; the ARP request frames are recorded as: Sent ARP request at 10:00 on April 1, 2025, Sent ARP request at 10:10 on April 1, 2025, Sent ARP request at 10:20 on April 1, 2025.

[0161] At 10:30 on April 1, 2025, 66:77:88:99:AA:BB sent an ARP response to 192.168.1.1 with a function code of 2, indicating that the response was received; if the function code is not 2, it means the response was not received, and the multi-dimensional high-granularity data corresponding to this ARP request is marked as an anomaly.

[0162] Rule 4: Data field conflict in ARP requests:

[0163] When D source MAC addresses are bound to the same target IP address, the target IP addresses in their ARP requests will be repeated, but the source MAC addresses are different.

[0164] Obtain the target IP address and source MAC address of the ARP request frame; group by the target IP address and obtain the number of different source MAC addresses in each group.

[0165] If the same target IP address corresponds to A source MAC addresses, mark it as an anomaly.

[0166] For example: When 192.168.1.1 is the target IP address, there are 4 different source MAC addresses (00:11:22:33:44:55, 00:11:22:33:44:56, 00:11:22:33:44:57, 00:11:22:33:44:58) sending ARP requests in a time slice (assumed to be 15 seconds); this is because multiple devices are competing for the same IP address, resulting in an anomaly, and the multi-dimensional high-granularity data corresponding to this ARP request is marked as an anomaly.

[0167] Through precise multi - rule anomaly detection, various potential anomalies in the network can be comprehensively identified and marked, especially those related to the ARP protocol. First, a high - granularity data set based on multi - dimensional features makes anomaly detection more meticulous and comprehensive, capable of identifying conflicts and problems in the network from different perspectives. Second, the rule design is flexible and highly targeted, including analyzing situations such as the frequency of ARP requests, multiple source MAC addresses competing for the same IP, mismatches between ARP requests and responses, and data - field conflicts in ARP requests, which can effectively detect address conflicts, device failures, or malicious behaviors in the network. This multi - rule detection mechanism not only improves the accuracy of anomaly detection but also can promptly identify and isolate the problem source to ensure the stability and security of the network.

[0168] Based on the anomaly data - frame data set, divide the conflict domain according to the time window, calculate the total traffic and the proportion of broadcast traffic in the conflict domain, and judge whether there is an address - conflict problem in the conflict domain through the total traffic and the proportion of broadcast traffic. If there is an address - conflict problem, the specific method of using VLAN for isolation includes:

[0169] Set a fixed time window, and define the abnormal data frames corresponding to the abnormal ARP requests within the time window as the same conflict domain;

[0170] For each conflict domain, calculate the total traffic and the proportion of broadcast traffic in the conflict domain;

[0171] The total traffic is the overall traffic within the conflict domain;

[0172] Proportion of broadcast traffic: Due to a large number of ARP requests caused by address conflicts, the proportion of broadcast traffic within the conflict domain may be relatively high;

[0173] Identify whether there is an address - conflict problem in the conflict domain based on the total traffic and the proportion of broadcast traffic;

[0174] Among them, select the total traffic in G historical time windows to calculate the average value and standard deviation, and calculate the total - traffic threshold based on the average value and standard deviation; select the proportion of broadcast traffic in G historical time windows to calculate the average value and standard deviation, and calculate the broadcast - traffic - proportion threshold based on the average value and standard deviation; if the total traffic and the proportion of broadcast traffic exceed the total - traffic threshold and the broadcast - traffic - proportion threshold, it indicates that there is an address - conflict problem in the conflict domain;

[0175] When it is determined as an address conflict, divide the source MAC addresses in the abnormal data frames in the conflict domain into an independent VLAN for isolation;

[0176] In an industrial network, address conflicts usually cause a large number of ARP request frames to be broadcast onto the network in an attempt to resolve the conflicting IP addresses. Since ARP requests are broadcast-type frames, when address conflicts occur among multiple devices in the network, a large number of ARP requests and responses are frequently generated, resulting in a significant increase in the proportion of broadcast traffic within the collision domain. In addition, address conflicts also cause network devices to continuously retransmit ARP requests, increasing the total traffic. Therefore, the abnormal increase in the total traffic and the proportion of broadcast traffic within the collision domain is usually an important indication of the existence of address conflicts in the network. By analyzing these traffic characteristics, it is possible to effectively identify and determine whether there is an address conflict problem.

[0177] The main advantages are that by combining abnormal data frames and traffic analysis, address conflict problems can be effectively identified and isolated. By calculating the total traffic and the proportion of broadcast traffic in the collision domain within a fixed time window, it is possible to accurately determine whether the collision domain has an abnormal increase in traffic due to address conflicts. By comparing with historical data and dynamically adjusting the traffic threshold, the judgment becomes more sensitive and adaptable. In addition, for the identified collision domain, by using VLAN isolation, the affected devices can be effectively isolated from the normal network, reducing network performance degradation and potential security risks. This method can respond to address conflict problems in the network in real time and automatically, improving network stability and security.

[0178] For each collision domain, the specific methods for obtaining the total traffic and the proportion of broadcast traffic in the collision domain include:

[0179] The method for obtaining the total traffic includes: using the network packet capture tool Wireshark to obtain the total length of abnormal data frames;

[0180] Calculating the combined length of all abnormal data frames in the collision domain, which is the total traffic;

[0181] A raw data frame has a set of high-granularity data with multi-dimensional features. A set of high-granularity data with multi-dimensional features includes the source MAC address, destination MAC address, frame type, timestamp, frame interval, the aging distribution characteristics of the frame interval, burst traffic patterns, function codes, and the data field.

[0182] Extract ARP request frames according to the frame type and analyze whether the ARP request frames are abnormal. Define the raw data frames corresponding to the marked abnormal request frames as abnormal data frames and sort them according to the timestamp to obtain an abnormal event dataset.

[0183] In the abnormal data frames, use the destination MAC address to determine whether it is a broadcast frame. The destination MAC address of a broadcast frame is FF:FF:FF:FF:FF:FF;

[0184] The method for obtaining the broadcast traffic ratio includes: traversing the destination MAC addresses of abnormal data frames in the collision domain using the traversal method to obtain the number of final broadcast frames;

[0185] Calculate the broadcast traffic ratio based on the ratio of the number of broadcast frames in the collision domain to the total number of abnormal data frames in the collision domain.

[0186] The specific method for establishing the communication relationship graph in the network includes:

[0187] The communication relationship graph consists of nodes and edges; where the source MAC address and destination IP address are used as nodes, and the timestamp, frame interval, burst traffic pattern, function code, and data field are used as edges; use the NetworkX tool to construct the communication relationship graph;

[0188] The main advantages are that it can comprehensively and intuitively display the communication relationships between various nodes in the network by constructing a detailed communication relationship graph; by using the source MAC address and destination IP address as nodes and information such as timestamp, frame interval, burst traffic pattern, function code, and data field as edges, it can accurately capture the dynamic characteristics and behavior patterns of network communication; using the NetworkX tool, these data can be flexibly processed and analyzed, quickly identifying potential network problems (such as abnormal traffic, malicious attacks, equipment failures, etc.), and providing strong support for subsequent network optimization and security protection; in this way, it is possible to more clearly understand network behavior and contribute to real-time monitoring and historical data analysis.

[0189] In this embodiment, by deploying a customized acquisition module at the data link layer, it is possible to capture the original data frames in the network in real time, including the data frames captured from physical ports, frame intervals, and protocol semantic features; this real-time nature ensures that problems in the network can be discovered and processed in a timely manner, avoiding the possible delay problems of traditional methods;

[0190] Use the dynamic time block analysis method to identify and analyze burst traffic patterns; this method determines whether the traffic is abnormal by defining dynamic time slices and calculating the frame density and traffic volume of each slice; this mechanism effectively detects burst traffic in the network, provides early warnings for network administrators, and helps to take timely measures to prevent network congestion or performance degradation;

[0191] This solution designs multiple rule sets based on multi-dimensional features for anomaly detection; by analyzing the source MAC address, destination IP address, and frame type of ARP data frames, potential abnormal behaviors can be accurately identified; through the comprehensive application of these rules, the accuracy of anomaly detection is improved, and false positives and false negatives are reduced;

[0192] When an address conflict is detected, by isolating the conflict domain into independent VLANs, it can effectively prevent the conflict source from affecting the entire network. This method determines whether there is an address conflict problem by precisely calculating the total traffic and broadcast traffic ratio in the conflict domain, avoiding waste of network resources and performance degradation.

[0193] By establishing a network communication relationship graph, it can clearly visualize the location of the conflict source and the communication relationships between various nodes in the network. This visualization method helps network administrators quickly locate the conflict source and improves the efficiency of fault troubleshooting.

[0194] By dynamically evaluating load metrics (such as frame rate, bandwidth utilization, CPU occupancy, etc.), it can flexibly adjust the time slice size according to the actual network load situation. This flexibility enables this method to maintain good performance under different network load states and adapt to various industrial environments.

[0195] Through the above-mentioned multiple technical means, the system can achieve all-round monitoring, real-time anomaly detection, conflict source isolation and location, and fault diagnosis of the industrial field network. It greatly enhances the network management and maintenance capabilities, and helps network administrators improve the reliability, stability, and security of the network in complex industrial environments.

[0196] Embodiment 2

[0197] Please refer to Figure 3 As shown, for the parts not described in detail in this embodiment, refer to the description content of Embodiment 1. Provide a data link layer parsing system in an industrial field network address conflict environment, including:

[0198] High-granularity feature acquisition module: Deploy a customized acquisition module at the data link layer to capture the original data frames of physical ports in real time, extract timing features and protocol semantics; and merge the timing features, protocol semantics, and basic information data into a high-granularity data set with multi-dimensional features.

[0199] Among them, the timing features include frame interval, the aging distribution feature of the frame interval, and the burst traffic pattern; the burst traffic pattern is obtained by calculating through the dynamic time block analysis method. In the dynamic time block analysis method, define a dynamic time slice, calculate the number of original data frames and the transmitted bytes in the dynamic time slice, and calculate the frame density and traffic volume; judge whether it is a burst traffic pattern based on the frame density and traffic volume.

[0200] Among them, the dynamic time slice is set by dynamically evaluating the network load and dividing it into low-load or high-load states, and setting the time slice according to the low-load or high-load state and the state between low load and high load.

[0201] Multi - rule anomaly recognition module: Based on a high - granularity data set with multi - dimensional features, design a multi - rule set, use multiple rules for anomaly detection, and perform marking to obtain an anomaly data frame data set;

[0202] Collision domain isolation and visualization module: Based on the anomaly data frame data set, divide the collision domain according to time windows, calculate the total traffic and the proportion of broadcast traffic in the collision domain, and determine whether there is an address conflict problem in the collision domain through the total traffic and the proportion of broadcast traffic. If there is an address conflict problem, use VLAN for isolation; for the isolated collision domain, visualize the conflict source by establishing a communication relationship graph in the network.

[0203] Embodiment 3

[0204] This embodiment publicly provides an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the computer program, it implements the operation mode of the data link layer parsing method in the industrial field network address conflict environment provided above.

[0205] Since the electronic device introduced in this embodiment is the electronic device used to implement the data link layer parsing method in the industrial field network address conflict environment of the embodiments of the present application, based on the data link layer parsing method in the industrial field network address conflict environment introduced in the embodiments of the present application, those skilled in the art can understand the specific implementation manners and various variations of the electronic device in this embodiment. Therefore, the specific implementation of how this electronic device implements the method in the embodiments of the present application will not be described in detail here. As long as those skilled in the art implement the electronic device used for the data link layer parsing method in the industrial field network address conflict environment of the embodiments of the present application, it belongs to the scope protected by the present application.

[0206] The above formulas are all dimensionless and take their numerical values for calculation. The formulas are obtained by collecting a large amount of data for software simulation to get a formula closest to the real situation. The preset parameters and threshold selection in the formulas are set by those skilled in the art according to the actual situation.

[0207] The above - mentioned are only the preferred embodiments of the present invention. The protection scope of the present invention is not limited to the above - mentioned embodiments. All technical solutions within the idea of the present invention belong to the protection scope of the present invention. It should be noted that for ordinary technical users in the technical field, several improvements and refinements made without departing from the principle of the present invention should also be regarded as within the protection scope of the present invention.

Claims

1. A data link layer parsing method in an industrial field network address conflict environment, characterized in that, Including: Step S1: Deploy a customized acquisition module at the data link layer to capture the original data frames of physical ports in real time, and extract timing features and protocol semantics; And merge the timing features, protocol semantics, and basic information data into a high-granularity data set with multi-dimensional features; Among them, the timing features include frame interval, aging distribution feature of frame interval, and burst traffic pattern; the burst traffic pattern is calculated by the dynamic time block analysis method; in the dynamic time block analysis method, define dynamic time slices, calculate the number of original data frames and the transmitted bytes in the dynamic time slices, and calculate the frame density and traffic volume; judge whether it is a burst traffic pattern based on the frame density and traffic volume; Among them, the dynamic time slices are set by dynamically evaluating the network load and dividing it into low-load or high-load states, and setting time slices according to the low-load or high-load states and the states between low load and high load; Step S2: Based on the high-granularity data set with multi-dimensional features, design a multi-rule set, use multiple rules for anomaly detection, and perform marking to obtain an abnormal data frame data set; Step S3: Based on the abnormal data frame data set, divide the conflict domain according to the time window, calculate the total traffic and broadcast traffic ratio in the conflict domain, and judge whether there is an address conflict problem in the conflict domain through the total traffic and broadcast traffic ratio. If there is an address conflict problem, use VLAN for isolation; for the isolated conflict domain, visualize the conflict source by establishing a communication relationship graph in the network.

2. The data link layer parsing method in an industrial field network address conflict environment according to claim 1, characterized in that, The specific acquisition method of the customized acquisition module includes: Step a1: Hardware interface and network adaptation: Use the Intel X520-DA2 dual-port 10G Ethernet network card as the physical interface of the acquisition module; the network interfaces are configured as eth1 and eth2; Step a2: Configure data link layer capture: Set the network card to Promiscuous mode to capture the frames passing through the network card; use the libpcap library to capture the original data frames at the data link layer; Step a3: Data traffic filtering and preprocessing: Integrate filtering rules to capture Modbus / TCP or Profinet protocol frames; Extract and record the following frame header information, including: source MAC address, destination MAC address, frame type, timestamp; Use CRC check technology to verify the integrity of the frame, and discard the frames with failed checks; Step a4: Data storage and buffering: Store the captured original data frames in a 2TB SSD hard disk in real time; adopt a FIFO caching mechanism to delete the oldest data when the cache exceeds the threshold; Step a5: Data transmission interface design: Use a 10G Ethernet interface to transmit the captured original data frames to the upper-layer analysis system in real time; Use the UDP protocol to package and send the data frames to the analysis server.

3. The data link layer parsing method in an industrial field network address conflict environment according to claim 2, characterized in that, The specific method for capturing the original data frames of physical ports in real time and extracting timing features includes: The timing features include frame interval, aging distribution feature of frame interval, and burst traffic pattern; Retrieve the timestamps in the original data frames; calculate the adjacent original data frame intervals for the timestamps corresponding to adjacent original data frames; Calculate the time - effect distribution characteristics of frame intervals, including the shortest interval, the longest interval, the average interval, and the interval divergence; Identify the burst traffic patterns in the data stream through the dynamic time - block analysis method; where the data stream consists of multiple original data frames.

4. The data link layer parsing method in an industrial field network address conflict environment according to claim 3, characterized in that The specific method for calculating the burst traffic pattern obtained through the dynamic time - block analysis method includes: Define dynamic time slices, aggregate the original data frames within the time slices, and obtain the number and transmitted byte count of the original data frames in the dynamic time slices; calculate the frame density based on the number of original data frames in the time slices and the time of the dynamic time slices; Calculate the traffic volume based on the transmitted byte count in the time slices and the time of the time slices; If the frame density or traffic volume in the P - th time slice exceeds the set limit, then a burst traffic pattern appears in this time slice, trigger the warning mechanism, and record the start timestamp and end timestamp of the burst traffic pattern.

5. The data link layer parsing method in an industrial field network address conflict environment according to claim 4, characterized in that The specific method for defining dynamic time slices includes: Obtain the load - metric data of the original data frames, including frame rate, bandwidth utilization rate, and resource occupancy rate; Define the load - metric data status classification rules according to the load - metric data, including: Low load: Frame rate < , Bandwidth utilization < , CPU occupancy < ; High load: frame rate ≥ , bandwidth utilization rate ≥ , CPU occupancy rate ≥ ; Among them, is the load threshold, which is obtained by using the progressive threshold update method; When the load is low, set the time slice to ; when the load is high, set the time slice to ; where and are the time slice sizes for low load and high load respectively; For the over - time slice, i.e., the load between low load and high load, set the time slice to be , , where is for controlling the over - rate.

6. The data link layer parsing method in an industrial field network address conflict environment according to claim 5, characterized in that The multi - rule set includes: Rule 1: Filter out ARP data frames according to the frame type in the high - granularity dataset of multi - dimensional features; For the same source MAC address in the ARP data frames, obtain the number of ARP requests for the same target IP address within the dynamic time slice; If the same source MAC sends J ARP requests within the time slice, it is marked as abnormal; Rule 2: For the corresponding target IP address in the ARP request frames; group by the target IP address and obtain the source MAC addresses in each group; if the same target IP address is requested by K source MACs in the time slice, mark the multi - dimensional high - granularity data corresponding to this ARP request as abnormal; Rule 3: For the ARP request frames and ARP response frames; For each ARP request frame, check whether there is a corresponding ARP response in the next time slice; if the ARP request sent by the source MAC address does not receive a response, mark it as abnormal; Rule 4: When D source MAC addresses are bound to the same target IP address, the target IP address in their ARP requests will be repeated, but the source MAC addresses are different; Obtain the target IP address and source MAC address of the ARP request frames; group by the target IP address and obtain the number of different source MAC addresses in each group; If the same target IP address corresponds to A source MAC addresses, mark it as abnormal; Sort the marked abnormal ARP request frames according to the timestamp to obtain the abnormal event dataset, where each group of data is defined as an abnormal data frame.

7. The data link layer parsing method in an industrial field network address conflict environment according to claim 6, characterized in that Based on the abnormal data frame dataset, divide the conflict domain according to the time window, calculate the total traffic and the broadcast traffic ratio in the conflict domain, and judge whether there is an address - conflict problem in the conflict domain through the total traffic and the broadcast traffic ratio. If there is an address - conflict problem, the specific method of using VLAN for isolation includes: Set a fixed time window, and define the abnormal data frames corresponding to the abnormal ARP requests within the time window as the same collision domain; For each collision domain, calculate the total traffic volume and the broadcast traffic volume ratio in the collision domain; Based on the total traffic volume and the broadcast traffic volume ratio, identify whether there is an address conflict problem in this collision domain; Among them, select the total traffic volume in G historical time windows to calculate the average value and the standard deviation, and calculate the total traffic volume threshold based on the average value and the standard deviation; select the broadcast traffic volume ratio in G historical time windows to calculate the average value and the standard deviation, and calculate the broadcast traffic volume ratio threshold based on the average value and the standard deviation; if the total traffic volume and the broadcast traffic volume ratio exceed the total traffic volume threshold and the broadcast traffic volume ratio threshold, it means that there is an address conflict problem in this collision domain; When it is determined to be an address conflict, divide the source MAC addresses in the abnormal data frames in this collision domain into an independent VLAN for isolation.

8. The data link layer parsing method in an industrial field network address conflict environment according to claim 7, characterized in that, The specific acquisition method for calculating the total traffic volume and the broadcast traffic volume ratio for each collision domain includes; The acquisition method for the total traffic volume includes: using the network packet capture tool Wireshark to obtain the total length of the abnormal data frames; Calculate the combined length of all abnormal data frames in the collision domain, which is the total traffic volume; The acquisition method for the broadcast traffic volume ratio includes: using the traversal method to traverse the destination MAC addresses of the abnormal data frames in the collision domain to obtain the number of final broadcast frames; Calculate the broadcast traffic volume ratio based on the ratio of the number of broadcast frames in the collision domain to the total number of abnormal data frames in this collision domain.

9. The data link layer parsing method in an industrial field network address conflict environment according to claim 8, wherein The specific method for visualizing the conflict source by establishing a communication relationship graph in the network for the isolated collision domain includes: For the isolated collision domain, retrieve the high-granularity data of the multi-dimensional features of the abnormal data frames in the collision domain, and establish a communication relationship graph in the network; and identify the conflict source in the collision domain through visualizing the communication relationship graph.

10. The data link layer parsing method in an industrial field network address conflict environment according to claim 9, characterized in that, The specific method for establishing a communication relationship graph in the network includes: The communication relationship graph is composed of nodes and edges; among them, the source MAC address and the destination IP address are used as nodes, and the timestamp, frame interval, burst traffic pattern, function code, and data field are used as edges; use the NetworkX tool to construct the communication relationship graph.

Images